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Abstract 

We propose a bit-oriented quantum public-key scheme which uses Boolean 
function as private-key and randomly changed pairs of quantum state and 
classical string as public-keys. Contrast to the typical classical public-key 
scheme, one private-key in our scheme corresponds to an exponential number 
of public-keys. The goal of our scheme is to achieve information-theoretic 
security, and the security analysis is also given. 
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1. Introduction 

Public-key encryption (PKE) is one of the important branches of cryptog¬ 
raphy, and has been widely applied into various fields. Classical public-key 
encryption is based on one-way function with the hardness of solving the 
computational difficult problem. Since the investigation to quantum Tur¬ 
ing machine was started and Shor’s algorithm as well as Grover’s algorithm 
were put forward, quantum public-key encryption (QPKE) emerged as times 
require. 

According to whether the encrypted messages and keys are in quantum 
states or not, we classify QPKE into four types. The first type is that 
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messages and keys are both classical. The Knapsack-based scheme [H pro¬ 
posed by Okamato uses classical key to encrypt and to decrypt classical 
messages, but the participants are all quantum probabilitic polynomial Tur¬ 
ing machine. The second type encrpts quantum messages with classical keys. 
The McEliece QPKE scheme proposed in was belong to this type. This 
scheme was based on a classical NP-complete problem related with Ending 
a code word of a given weight in a linear binary code. With this foudation, 
Yang et ah gave the definition of induced trapdoor one-way quantum 
function. Fujitaj^ also constructed McEliece QPKE relied on the difficulty 
of NPC problem. The third type refers to classical messages and quan¬ 
tum keys. Gottesman and Chua^ were the first to construct quantum 
states as public-keys. Kawachij^, Q investigated the cryptographic property 
’’computational indistinguishability” of two quantum states generated via 
fully flipped permutations and proposed a QPKE based on it. Nikolopou- 
los jsl constructed a QPKE from the perspective of single-qubit rotation 
and trapdoor one-way function, also proposed a information-theoretic se¬ 
cure QPKE designed with conjugate coding single-photon stri^. The fourth 
is with quantum messages and quantum keys. Gottesman 10| proposed a 


QPKE based on teleportation with information-theoretic security. Liang et 
al. ini combined the basic idea of [l^ and quantum perfect encryption to 
construct an information-theoretically secure QPKE. Kawachi and Pormann 
Til l presented another kind of quantum message-oriented public-key encryp¬ 


tion protocol with quantum public-key, but they show this scheme is bounded 
information-theoretic secure. 

In this paper, we invetigate the way to construct bit-oriented public-key 
encryption scheme. Firstly, we overview some definition about information- 
theoretically security about QPKE and quantum perfect encryption. Second, 
we present a new bit-oriental public-key encryption scheme. Finally, we 
investigate the scheme’s security against attack to the key and attack to the 
encryption and prove that the scheme is information-theoretically secure. 


2. Preliminaries 

2.1. Information-theoretic security 

Goldreich [l^ defined the ciphertext indistinguishability in classical PKE: 
for every polynomial-size circuit family c„, every positive polynomial p(-), all 


2 




sufficiently large n, and every x,y E {0,1}*, satisfies: 


Pr [C„(G(l”),Ec(i.)(i)) = 1] - Pr [G„(G(1”), Bg(i.)(!/)) = l]| < (t 


Similar to the ciphertext indistinguishability in classical context, [l^ extend 


the concept to QPKE and presented the definition of information-theoretic 
quantum ciphertext-indistinguishability for public-key encryption of classical 
messages: 

Definition 1. A quantum public-key encryption scheme of classical messages 
is information-theoretically ciphertext-indistinguishable, if for every quantum 
circuit family {Cn}, every positive polynomial p{-), all sufficiently large n, 
and any two bit-string x,y E {0,1}*, satisfies: 



where G is key generation algorithm, E is a quantum encryption algorithm, 
and the ciphertext E{x), E{y) are quantum states. 

(l^ also proved that a quantum public-key encryption scheme is information- 
theoretically secure if the trace distance between any two cihpertexts is 


O(^), and Eq. (1) holds. 


Definition 2. Eor all plaintext x andy, let the density operators of ciphertext 
E{x) and E{y) be and Py respectively. A quantum public-key encryption 
scheme is said to be information-theoretically secure, if for every positive 
polynomial p(-) and every sufficiently large n, satisfies: 
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( 3 ) 


2.2. Quantum perfect encryption 

Assume a set of oeprations Uk, each is a 2"’ x 2”' unitary matrix. The 
ciphertext state of n-qubit quantum message p is pc- k refers to private-key, 
each k is chosen with probability pk. To encrypt, applying Uk to p: 


pc = UkpUl 


( 4 ) 


The private-key owner can use to decrypt: 

P = UlpU, 


( 5 ) 
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As defined in 
mixed state: 


16l |: for every input state p, the output state is an ultimately 


^PkUkpU+ = ( 6 ) 


That is: 

{Pk = ■^,Uk = U^U 2 ,k = {a, (3), a, (3 G {0,1}"'} is a quantum perfect 
encryption, where Uk = constitute a complete orthogonal basis. 


2.3. Simple description of QPKE in 112] 


The QPKE in 0 consists of three phases: key generation, encryption 
and decryption. 

Suppose that fin = {k E Z 2 -n\WH{k) is odd}, If^ = {fc G Z 2 r<.\WH{k) is even}. 
Wh denotes the hamming weight of A:. In this scheme dehned two n-qubit 
states: 


Pli = ^i\i)+ \]®k)){{i\ +{i®k\) (7) 

and 

Pk,i = \{\i) - K ® ^))((^l - (^ ® (8) 


where i G Z 2 n, k G fin- 

[Key Generation] 

1. Bob randomly selects a Boolean Function as his private-key from the 
mapping set F : (0,1}™ i—)■ {0,1}", and also chooses a bit string s, 
s G Z 2 'f^ 5 

2. Bob computes F{s) = k, and then prepares quantum state ^ accord¬ 
ing to the string k E fin, i E Z 2 ^', 

3. Bob sends his public-key (s,p° J to the public register. 

[encryption] 

1. Ailce download Bob’s public-key from the public register; 
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2. if she wants to send message ”0”, she sends J to Bob; if the 
message is ” 1”, she does on ^ to acqnire p\ then sends (s, pi J 
to Bob. 

[decryption] 

1. Receiving the message send from Alice, Bob nses his private-key F to 
compnte F{S) = k] 

2. Using a bit ”1” in k as controlled bit to do CONT operation to other 
bits in the qnantnm state, then measuring the quantum state with basis 
{|-1-), |—)} to get the message. 


2.4- Attack method 

presented an effective attack for the scheme descrpted in 2.4. The 
concrete steps are as follows: 

1. when an attacker gets user’s public-key (s, J, he does random Hadamard 
transform to the quantum state p° p 




■V2 


(|i) + \i®k))] 


^^(_i).-.(i + (_i).qi,) (9) 


2. Attacker measures \y), and gets po- 

Uo satishes i/o-k = 0. That is to say, it satishes the equation po■ F{s) = 0. 
The Boolean function is n-input and n-output, it can be expressed as: 

F(s) = (F«(s),...,F(")(s)) (10) 

The minor term expression of every F^^\s) is: 

•...• 4 ^ 1 " )©...© ( 11 ) 

Since that x°' = a:a©a© 1, we rewrite the Boolean function in linear expres¬ 
sion: 

p{n) n 

F^^\s) = ^(]^(S/3ajQ,/3 + Oja,/? + 1)) (12) 

a=l 13=1 

So the attacker gets the equation about F{s), he will be able to acquire 
information about user’s private-key F. 
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3. bit-oriented public-key encryption 

3.1. preparition of quantum state 

Firstly, we take into account how to construct the quantum state used in 
this scheme. The quantum state is 

/>S = 5(|0> + |A^))({0| + (*:|) (13) 

The concrete steps of preparing quantum state is as follows: 

1. Prepare quantum state |0) 0 |0) and two quantum registers. Applying 
Hadamard transform to the hrst register, the state of the whole system 
becomes: 

{H 0 /®")(|0) 0 |0)) = Mljll 0 |0) (14) 

V2 

2. Dehne controlled-k operator Cfe as: Cfc|0)|0) = |0)|0), Cfc|l)|0) = |1)|/^), 
Ck can be realized via a group of CNOT operations. We get the state: 

^(|0)|0) + |l)|«:)) (15) 

3. Use one of the non-zero bits in k to do CNOT to the first register, then 
obtain: 

T(|0)|0) + |0)|«:» (16) 


Finally, we get the state 

can be obtained by applying Z®” on p°^. 

Remark 1. There is another way to prepare p°p 

1. prepare n-qubit quantum state |0), and select the jth qubit ”0^” which 
at the same time satishes kj = 1 in |0) to do Hadamard transform: 

|0i,...,0,_,>(MUU.)|0,^,,...,0„), 
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2. use all the ”1” in k to do CNOT on the above quantum state, we 
acquire: 

^(| 0 >+ !«:». 

Compared with the previous one, this method is more efficient because of 
that the total number of CNOT operation decreased by two. 

3.2. detail description of bit-oriented public-key encryption 

Let ki e 0„, ki = {kn, • • •, kin}, k 2 = {k 2 i,..., k 2 n} and ks = {k^i,..., k^n] 
are bit strings, where each element is in {0,1}. We denote ® 

• • • (g) where = I, = H. The dehnition is similar with 

[Key Generation] 

1. Bob selects randomly two Boolean function F = {Fi,F 2 ,F^) from 

F : {0,1}™ e-)■ {0, as his private-key, and also chooses two string 

s = (si, 52 , 53 ) randomly from the set { 0 , 1 }™' to do the computation 
Fi(5i) = ki, ^ 2 ( 52 ) = k 2 , Fsi^ss) = ks to get k = {ki, k 2 , k^). If ki ^ Qn, 
Bob selects 5i again until ki G On; 

2. Bob uses ki to prepare quantum state p°^,and then does Hadamard 
transform on to get the quantum part of public-key according to 

k2: 

+ |A;i))((0| + {ki\)H®^^Y®^^ (17) 

3. Bob stores in the quantum registers as his public-key. 

[encryption] 

1. Alice downloads Bob’s public-key from quantum registers; 

2. if Alice wants to send message 0, she sends to Bob; if she 

sends 1, she does transform as bellow: 

pUs) = 

= + |A;i))((0| + {ki\)H®^^Y®^^Y®^ 

= iy®fc3^0fc2('|^^ _ |^))((i| _ (^\)Y®^^H®^\ (18) 
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where the length of n is even, 

3. Alice sends to Bob; 

[Decryption] 

1. Bob uses s = (si, S 2 , S 3 ) and F = (Fi, F 2 , F 3 ) to compute k = (fci, k 2 , /C 3 ); 

2. Bob uses /c 2 , ks to remove transforms on the ciphertext state 

3. Bob sums the 2th and nth qubit to the hrst component. If the trans¬ 
mitted message is 0, the quantum state becomes: |0i, O 2 ,..., 0„) -|- 
|li, /c 2 ,..., kn), and then he uses the first bit in the second component 
\ki) as controlled bit to do CNOT operation to other bits in this state: 
|0i, O 2 ,..., 0„) -|- |li, O 2 ,..., 0„). If the transmitted message is 1, the 
quantum state after operation is: |0i, I 2 ,..., In) — |li, k 2 , ■ ■ ■, kn), and 
takes the hrst bit in ki as controlled bit to do CNOT operation to other 
bits to get the state: |0i, O 2 ,..., On) — |li, O 2 ,..., On). Finally, Bob mea¬ 
sures the quantum state with basis {|-1-), |—)} to get the message. 

Remark 2. The Boolean function F can be generated efficiently. For the 
m-input, n-output F = {F^^\s),..., F^'^^s)), each output F0 )(s) has p{n) 
terms. The minor term expression of every (s) is: 

F^^\s) = (20) 

Each term •.. .■Sn°'"' can be determined by n times of coin tossing. If we 
toss the coin for np{n) times, p{n) components are determined. Therefore, 
the Boolean function F will be efficiently generated by n‘^p{n) times of coin 
tossing. 

4. Security analysis 

The security of the bit-oriental quantum public-key encryption scheme 
proposed above is analyzed from two aspects: ( 1 ) the security of private-key; 
( 2 ) the security of encryption. 



4 - 1 . security of private key 

The quantum part of public-key is Since the adversary has no 

idea of private-key F = {Fi, F 2 , F 3 ), the public-key state for him is = 
J 2 pfPf(^s)- specihc expression of Pp(^s) 

l(|o) + |A;i))((0| + (fell) (21) 

Thus, we have: 

P° = '^PFP^is) 

F 

= i 5^(|0) + |*:i))({0| + («:,|)]i/®'==y®'=» 

^ 2,^3 ^1 

_ ^ p(Y'^ri (22) 

k2M 

where 

p = + + <*''!)■ ( 23 ) 

ki 

Since ki G {0,1}", the possibilities of the value of ki is 2". The Boolean 
function -Fi(si) has n-output, and each output has p{n) terms, so vfpin) 
times coin tossing will determine Fi{si). n‘^p{n) times coin tossing has 2” 
possibilities. The possibilities of T’i(si) is times of that of ki. So the 

output of private-key T’i(si) iterates over all the possible value of ki. {k^, F^) 
and {k2,iF^) is the same case as {ki^Fi). 

Before demonstrate the quantum state of is an ultimately mixed state, 
we hrstly prove: {pk = -^lUk = Y‘^H^,k = (a,/9), a,/9 G {0,1}"'} is a 
quantum perfect encryption. 

Proof. a, P E (0,1}"} is complete orthogonal basis, therefore any n- 

qubit state can be expressed as a linear combination of 2" unitary matrices: 

p = (24) 
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where 


(25) 

a,l3 

= ^tr{a^,0+ Y1 (26) 

77^0; or 5^0 

In the above equation is either a ^ 'j or 13 ^ S, moreover, tr{Y) = 0, 
tr{H) = 0, so tr{ ^ (^_iY^W+{myiY<^+i^3+5^ = 0. 

77^0; or 6^0 

Yr(Y,<‘a.0Y‘‘HfH‘Y^) = lo„,e (27) 


k 7,(5 

Oi,0 7,(5 

a,0 7,(5 

= 5sE“”-pE(-l)“'(-l)'’‘''^“-^t (28) 

a,0 7,(5 

because of ^ Y1 (—1)^'^ = 5/3,o, J^PkUkpUl is as bellow: 

7 e{ 0 ,l}" k 


YPi^^kpUl = 

t a,p 

= aQoI 

tr{p) j 

2 n 

I 

~ 2^ 


(29) 

□ 
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The proof shows that whatever the concrete state of p is , the ciphertext 
getting by quantum perfect encryption is an ultimately mixed state. More 
specihcally, the ciphertext has nothing to do with the encrypted key with the 
condition that the encyrpted key is unknown to the owner of the ciphertext. 
Then we have that p° = YIppP^pu) ciphertext encypted by quantum 

perfect encryption: 


^ ( 30 ) 

F 

The quantum part of public-key is ultimately mixed state for the adver¬ 
sary, so he cannot acquire any information about private key F = (Fi, F 2 ,Fs) 
by measuring such state. Moreover, according to the proposed scheme, only 
one copy of each quantum public-key (s, is allowed to be generated from 
the pair of {s,F). Thus, any two public-keys for user is different and one 
private key corresponds to an exponential number of public-keys. Extracting 
the value of ki, /c 2 and by measuring is the same as attacking one-time- 
pad in classical cryptography. Therefore, extracting the value of /ci, k 2 and 
^3 is information-theoretically impossible. Furthermore, extracting the rela¬ 
tionship between si, S 2 , S 3 and /ci, /c 2 , k^ are also information-theoretically 
impossible. 


4 -2. security of the encyrption 

Now, we analyze the second aspect and prove the proposed scheme has 
information-theoretic security. 


Proposition 1. The trace distance between any two different ciphertext 
states encrypted by the same private-key is zero. 


Proof. Let P^pi^s) ciphertext state of message ”0” and Pp^g^ be the 

ciphertext state of message ” 1 ”. P%'{^s) Pf{.s) both encyrpted by the 
same private-key F = {Fi, F 2 , F 3 ). s = (si, 52 , 53 ) is also unchanged for 
encrypting Pp(^g) and For adversary, he doesn’t have private-key, the 

quantum state for him is p^ = YpfPf(s)- 

If the transmitted message is ” 0 ”, the ciphertext state for the adversary 
is: 


1 


[ZdO) 


(31) 
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the ciphertext state, as demonstrated in Sec.4.1, is an ultimately mixed state: 

= — 

H 2" 

If the message is 1, the ciphertext state for the adversary is: 


n,k2, f fcijfcs 




The ciphertext state for the adversary is: 


P = 


pfpf(s) 

F 

J ^ ^ [k®'-(| 0) +1«:,))((0| + (fci)y®'- 




n,/c2 


ki,kz 




(33) 


where 


n,k2 


P = 


22n 


^ Jy®fc3(|0) + |A;,))((0| + {ki\)Y®'^^ 




(34) 


The ciphertext state for message ” 1” which can be considered as a quantum 
perfect encryption is also an ultimately mixed state for adversary: 


P^ = 


(35) 


When the same private key is used to encrypt message ”0” and ”1”, the 
trance distance between p° and is: 


D(.p",F) = 0 


(36) 


The sufficient condition of indistinguishability of two quantum states is that 
the trace distance betwenn two quantum is negligible. Because of D{p^, p^) = 
0, it’s impossible for the adversary to distinguish and p^. 

□ 

Remark 3. Assume that adversary intercepts some ciphertext states and 
attacks private-key by using {C„} which is denoted as any quantum circuit 
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family that can distinguish between and p^. Quantum circuit family {Cn} 
is a set of unitary transform, and the operation executed by {Cn} is linear. 
Given series mixed states ^ P^F"(s) {^n} one by one as inputs, 

equals to take = J2pfP^f{s) input. The operation of summing P^f(^s) 

over the whole set of private-key F and the operation done by {Cn} are 
commutative. That is, the following two inequality are equivalent: 


Pr[G„(p°) = l]-Pr[G„(/) = l] 


< 


Pr 
1 

pin) ’ 


CnC^PFp^s)) = 1 -Pr CnC^PFp^F(s)) = 1 


and 


Pr Cn{p\s)) = 1 


Pr 


^ri{PF{s)) — 1 


< 


pin) 


(37) 


(38) 


Proposition 2. The trace distance between any two different ciphertext 
states of the same plaintext is zero. 

Proof. Let (^pis) 7*0 the ciphertext state of message ”b” encrypted by private- 
key F = (Fi,F 2 ,F 3 ) and be the ciphertext state of message ”b” en- 

cyrpted by private-key F' = iF[, F^, F}). But s = (< 51 , 52 , 53 ) is unchanged 

for encrypting message b. For adversary, he doesn’t have private-key, the 

quantum states for him are = J^PFf^Fi^s) 

F jp 

If the transmitted message ”0” is encrypted by private-key F = (F^, F 2 , F 3 ), 
the ciphertext state for adversary is: 

1 


23r, 


Y. [5^(io) + |i;))((oi + {i;i) 




(39) 


As demonstrated in Proposition 1, the above chiphertext state is an ulti¬ 
mately mixed state which has nothing to do with and ^ 2 - 

If the transimitted message is 1 encrypted by private-key F = (F^, F 2 , F 3 ), 
the ciphertext state for adversary is: 


1 




n^k^ 


1 


\i\0) + \k[))i{0\ + {k[\)Y^’^'^ 


H 


iSlfco 


k. ,k„ 


y®n,(4o) 
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the ciphertext state for message ”1” is also an ultimately mixed state for 
adversary. 

Through above analysis, we get the equation: 

Dia^al) = 0 (41) 


If the adversary intercepts two different ciphertext states of the same plain¬ 
text, he is unable to distinguish them. □ 

Remark 4. When the attacker gets np{n) variables, he can get one bit of 
private-key in Ffl/ . Considering the extreme situation, if the attacker has 
acguired n — 1 bis of privat-key, he guesses the last bit wrongly with probability 
\ and will get the guantum state as bellow: 


| 00 ) + | 11 ), 


and then he does Hadamard transform on the first gubit: 


| 00 ) + | 11 ) 


H 


| 0 )( 


| 0 ) + | 1 ) - 

V2 ■ 


+ | 1 )( 


| 0 )-| 1 ) 

^/2 


)• 


(42) 


(43) 


When measuring the state, the attacker gets the right one with probability 
so the probability of the attacker to decide the correct last bit is When 
attacker is lack of I bits, the probability to get the right private-key is ^ 
i(l — ^). Since = 0, the attacker cannot attack successfully using 

this method 


5. Discussion 


The proposed bit-oriented QPKE uses private key to do Hadamard trans¬ 
form on the quantum state to hide the information about i, ki and k 2 - In 
pointed out that if the quantum state of pub lie-key is \i) \i (B k), the 
adversary is able to extract all the information about private-key by apply¬ 
ing only random Hadamard transform on public-key state. So the scheme 


constructed in [1^ took \i) \i (B k) as its public-key is insecure even in 


the lower bound of private-key. The proposed scheme in this paper aims at 
encrypting classical message and the public-key will be used only once to 
encrypt one bit. One private-key corresponding to exponential public-keys 
and one private-key can encrypt exponential classical bits. 
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For encrypting one-bit, proposition 1 and 2 cannot asnre that this shceme 
information-theoretically secnre, we also need to consider the trace distance 
between X]Pf ® This situation refers to that the 

F F 

attack intercept t — 1 public-keys as auxiliary information. For simplicity, we 
consider the case Yh P^f'- 

F 


J2pf®Pf 

F 

fc2 fcijfca 

Hk2 


®Y^^m + \ki))m + {ki\)Y^^ 

1 

^-1 

k2 ki,k3 

+ \ki © ks, ki © k 3 ){k 3 , PsI + \ki © P3, p3)(p3, Pi © P3I) 


^(|p3, p3)(p3, P 3 I + |Pi©p3,p3)(Pi©p3,p3| 


H 


k 2 


(44) 


Such situation is complex, so D{YiP%Y^P f © (Pf)'^ be 

F F 

effective computed. 

The premise of the bit-oriented QPKE is that the quantum key distribu¬ 
tion is secure, therefore we concentrate in the study of QPKE. However, how 
to ensure the quantum key is distributed securely is an important problem 
which worth the effort to research on. 


Classical PKE relies on one-way function, one-way function [l^ is based 
on computational complexity hypothesis. It is a function that it is easy to 
compute f{x) for every x in the domain of /, but the reverse calculation is 
difficult. More specihcally, for all y in the range of /, it’s hard to hnd x 
satishes y = f{x) in expected polynomial time. We wonder whether QPKE 
is also based on one-way function, and what’s the one-way property of QPKE 
under the assurance of quantum mechanics. 

CCAl, CCA2 and semantically secure are all concerned about the security 
of classical PKE. The quantum counterparts of these also needs to be further 
developed. 
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6. Conclusions 


This paper studies bit-oriented quantum public-key encryption. The 
features of our scheme is: (1) private-key is Boolean function, (2) public- 
key is a pair of classical string and quantum state, (3) one private-key 
corresponds to an exponential number of public-keys, (4) this scheme en¬ 
sures information-theoretically security. We analyze the proposed QPKE is 
information-theoretically secure if every private-key used o{n) times and the 
security with the cases including attack to the privat-key and attack to the 
encryption. 
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